CVE-2024-1046 in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin
Summary
by MITRE • 02/06/2024
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'reg-number-field' shortcode in all versions up to, and including, 4.14.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The CVE-2024-1046 vulnerability affects the ProfilePress WordPress plugin, specifically targeting the 'reg-number-field' shortcode functionality within versions up to and including 4.14.3. This represents a critical security flaw that enables stored cross-site scripting attacks through improper input validation and output escaping mechanisms. The vulnerability exists within the plugin's handling of user-supplied attributes, creating a persistent threat vector that can compromise user sessions and execute malicious code within the context of affected websites.
The technical flaw stems from insufficient sanitization of input parameters passed through the reg-number-field shortcode, combined with inadequate output escaping of user-supplied data. When authenticated users with contributor-level permissions or higher submit content containing malicious scripts through the plugin's registration form fields, these scripts are stored in the database and subsequently executed whenever other users access pages containing the vulnerable shortcode. This stored XSS vulnerability operates through the standard WordPress plugin architecture where user-generated content is processed and rendered without proper security controls.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with persistent access to compromised systems through the authenticated user accounts. Attackers can leverage this vulnerability to steal session cookies, perform unauthorized actions on behalf of legitimate users, redirect victims to malicious sites, or even escalate privileges within the WordPress environment. The vulnerability affects all users who have access to the plugin's registration form functionality, making it particularly dangerous in multi-user environments where contributors and editors may have elevated permissions.
Organizations should immediately update to the latest version of the ProfilePress plugin to remediate this vulnerability, as no effective workarounds exist for the stored XSS flaw. The vulnerability aligns with CWE-79 (Cross-Site Scripting) and maps to ATT&CK technique T1566.001 (Phishing: Spearphishing Attachment) and T1059.001 (Command and Scripting Interpreter: Visual Basic), as attackers can use this vulnerability to establish persistent access and execute malicious payloads. Security teams should monitor for suspicious activity in user registration forms and implement additional input validation measures, while also reviewing user permissions to limit access to potentially vulnerable plugin features. The vulnerability demonstrates the critical importance of proper input sanitization and output escaping in web applications, particularly within content management systems where user-generated content is prevalent and security controls must be robust enough to prevent persistent threats.